Preparing for stage 1 and stage 2 certification audits

Two stages, two different questions

Accredited initial certification follows ISO/IEC 17021-1, which splits the audit into two stages. Stage 1 asks whether you are ready to be audited. Stage 2 asks whether the management system actually works across the scope you have applied for.

Keeping those questions apart helps you prepare. Stage 1 is mostly about design and documentation, while stage 2 is about evidence of operation over a period of time. A system written the week before stage 1 can pass stage 1 and still struggle at stage 2, because there has not been time to generate records.

The gap between the two stages is set by the certification body, taking account of how much needs to be resolved after stage 1. Use it to close the concerns raised rather than to start new projects.

What stage 1 checks

Stage 1 is often partly or wholly on site, though some elements can be done remotely depending on the standard and the risks involved. The auditor reviews your documented information, confirms the scope and sites, and checks that the system has been running long enough to audit.

The output is a report that lists any areas of concern which could become nonconformities at stage 2. Treat these seriously. They are not formal findings yet, but if they are still open at stage 2 they usually become nonconformities.

• The proposed scope, sites, processes and any exclusions or non-applicable requirements.
• Your understanding of context, interested parties and applicable legal requirements.
• Key documented information, such as policy, objectives and required procedures.
• Whether internal audit and management review have been planned and carried out.
• Site-specific conditions and the resources needed for stage 2.

What stage 2 checks

Stage 2 is an evaluation of implementation and effectiveness. The audit team follows processes from end to end, interviews people who do the work, samples records and observes activities. They are looking for evidence that you do what the system says, and that the system meets the standard.

For ISO 9001 that means customer requirements, operational control and measurement of performance. For ISO 14001 it means significant environmental aspects, compliance obligations and operational controls. For ISO/IEC 27001 it means the risk assessment, the Statement of Applicability and the controls that follow from them.

Documents and records to have ready

Auditors do not need a document for every activity. They need the documented information the standard requires, plus whatever you have decided is necessary for your own processes. A lean set that people use is better than a large set no one reads.

Before stage 1, check that every document has an owner, a version and a date, and that superseded copies are out of circulation. Auditors often find that the version on the shared drive differs from the one people use at their desks, and that is an avoidable finding.

• Scope statement, policy and measurable objectives with progress records.
• Risk and opportunity assessment, plus the standard-specific registers such as aspects, hazards or information security risks.
• Legal and other requirements, with evidence of evaluating compliance where the standard requires it.
• Competence, training and awareness records for people in the scope.
• Operational records that show processes running, such as orders, inspections, changes or incidents.
• A completed internal audit programme and the minutes or record of a management review.

Internal audit and management review come first

Certification bodies expect at least one full cycle of internal audit and management review before stage 2. These two activities show that the organisation can examine itself and act on what it finds, which is the core of any management system.

The internal audit should cover the whole scope and all requirements of the standard, not only the areas you think are weak. Internal auditors should not audit their own work. Management review should use real inputs, such as audit results, performance against objectives and customer or interested party feedback, and should record decisions and actions.

Major and minor nonconformities

A major nonconformity is one that affects the capability of the management system to achieve its intended results, such as a required process that is missing or a systemic failure. A minor nonconformity is a lapse that does not undermine the system as a whole, such as an out-of-date record or a single missed step.

Certification cannot be granted while a major nonconformity is open. The certification body has to verify the correction and corrective action, which may mean a follow-up visit or a review of evidence. ISO/IEC 17021-1 states that if this cannot be verified within six months of the last day of stage 2, another stage 2 has to be carried out before certification can be recommended.

For minor nonconformities, the certification body reviews and accepts your plan for correction and corrective action, and checks its implementation at the next audit. Our certification rules set the deadlines for submitting plans.

Writing corrective actions that close

A correction fixes the instance; a corrective action removes the cause so it does not happen again. Auditors reject plans that only repeat the correction or that blame individuals without asking why the process allowed the error.

State the root cause in a sentence, describe the change to the process, name an owner and a date, and say how you will check it worked. Keep the evidence together so the auditor can verify it in one place.

Where several minor nonconformities share a cause, say so and address the cause once. A pattern of related minor findings can be graded as a major nonconformity if the underlying cause is left alone.

On the day

Agree the audit plan in advance and make sure the people named in it are available. Give the team a quiet room, access to the records they ask for and a guide who knows the site. Answer the question asked, show the record, and say so if you do not know; auditors would rather follow up than receive a guess.

At the closing meeting the lead auditor summarises the findings and the recommendation. Ask questions there if any finding is unclear, because it is easier to clarify the evidence while the team is still on site than after the report has been issued.